CVE-2026-3296 — exposed on the internet

CVE-2026-3296: CWE-502 Deserialization of Untrusted Data in wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder

Internet exposure observed by OffSeq scans · last 30 days

Found on 1 internet-exposed hosts by OffSeq scans; no in-the-wild exploitation has been observed against OffSeq honeypots in this window.

About CVE-2026-3296

The Everest Forms WordPress plugin up to version 3.4.3 contains a critical vulnerability (CVE-2026-3296) involving PHP Object Injection via unsafe deserialization of untrusted input from form entry metadata. An unauthenticated attacker can inject a serialized PHP object payload through any public form field, which is stored in the database and later unserialized without class restrictions when an administrator views entries. This can lead to full system compromise due to the high severity of the vulnerability.

Vendor: wpeverestCWE-502

OffSeq internet scanning found CVE-2026-3296 on 1 exposed hosts in the last 30 days. OffSeq honeypots have not recorded in-the-wild exploitation of this CVE in the current window — this page tracks its exposure footprint and status; if exploitation begins, the live honeypot signal will appear here.

References